Xero API: how to connect Xero to your other systems

Short answer: the Xero API lets other systems read and write data in Xero, such as contacts, items, invoices, payments and bank transactions. You can connect Xero to other systems in three ways: with a ready-made app from the Xero App Store, with a connector tool such as Zapier, Make or n8n, or with a custom integration built directly on the API. The same three options apply to QuickBooks and Sage.

What is the Xero API?

Xero has been around since 2006 and says it serves 5 million customers in more than 180 countries, and that it leads cloud accounting in the UK (Xero). The API is the door in. It lets your online shop, CRM or payment system create invoices, update contacts and fetch accounting data without anyone typing the same thing twice.

Technically it is a REST API over HTTP. By default all successful responses on the accounting API come back as XML, and you get JSON by setting the Accept header to application/json. Invoices, quotes and credit notes can also be fetched as PDF (Xero Developer).

What can you connect?

Access is controlled by scopes. Xero is replacing broad scopes with granular ones. Since March 2026, all new and existing web apps have granular scopes, such as separate scopes for invoices and payments, and broad scopes remain available until September 2027 (Xero Developer).

Three ways to connect Xero

1. Ready-made app

Xero integrates with more than 1,000 apps (Xero), listed in the Xero App Store (Xero). For Shopify there is a free integration built by Xero itself, which syncs sales, payouts, fees and taxes (Xero App Store). A ready-made app is the quickest and cheapest route when the flow is standard.

2. Connector tool

Zapier has a Xero app with ready-made templates, though Xero counts as a premium app there (Zapier). n8n has an official Xero node (n8n Docs), and Make has a Xero app too. Connector tools suit simple flows across several systems without writing code. Read more in What is n8n?

3. Custom integration

A custom integration is built directly on the API to your rules. It pays off when the flow is unique, when many systems are involved, or when ready-made apps cannot handle your exceptions, such as customer-specific prices, several warehouses or particular VAT rules.

Read more about how we build Xero and QuickBooks integrations and connect other tools through system integration.

What does it cost?

For the business using Xero, the subscription is the main cost. Xero's UK plans are Ignite, Grow, Comprehensive and Ultimate, from £18 to £70 a month excluding VAT at standard prices (Xero). On top of that comes the cost of the integration: a monthly fee for an app or connector, or development time for a custom build.

For developers, Xero changed its model on 2 March 2026. Apps now sit in one of five tiers, Starter, Core, Plus, Advanced and Enterprise, priced by the number of connected organisations and the data transferred. Starter is free for up to five connections, which suits a business building an integration for its own organisation. The old revenue share for App Store apps has been retired (Xero Developer). The new terms also forbid using API data to train AI models.

How the API works technically

This section is for anyone building or commissioning an integration.

Sign-in with OAuth 2.0

The customer approves the integration with their normal Xero login and chooses which organisation it can access. The integration then gets an access token that lasts 30 minutes and a refresh token that lasts 60 days. Refresh tokens rotate, so each refresh returns a new one, and you need the offline_access scope to get them at all (Xero Developer).

A call that fetches invoices looks like this:

GET https://api.xero.com/api.xro/2.0/Invoices?page=1
Authorization: Bearer <access token>
Xero-tenant-id: <organisation id>
Accept: application/json

Limits

Per organisation, Xero allows 5 calls in progress at a time and 60 calls a minute. The daily limit is 1,000 calls on the Starter tier and 5,000 on higher tiers. Across all organisations, an app can make 10,000 calls a minute. Every response shows how much is left in headers such as X-MinLimit-Remaining (Xero Developer). Lists are paged, with a default of 100 items and a maximum of 1,000 per page (Xero Developer).

Real-time events

Instead of polling Xero for changes, an integration can subscribe to webhooks, for example when a contact, invoice or credit note is created or updated (Xero Developer). The event says what happened, and the integration then fetches the full record through the API.

Security

Give the integration as few scopes as possible, store tokens encrypted and log every sync so you can trace what happened.

QuickBooks, Sage and Making Tax Digital

QuickBooks Online also has a REST API with OAuth 2.0. Intuit limits it to 500 requests a minute and 10 concurrent requests per company (Intuit Developer). Sage Accounting has its own REST API with OAuth 2.0 as well. The integration patterns above work the same way for all three.

For UK businesses, integrations matter more because of Making Tax Digital. All VAT-registered businesses should now keep digital records and file VAT returns with compatible software (HMRC). Since 6 April 2026, sole traders and landlords with qualifying income over £50,000 also need MTD for Income Tax, with the threshold falling to £30,000 in 2027 and £20,000 in 2028 (HMRC). The fewer manual steps between your sales and your accounts, the easier that is.

Common pitfalls

• Duplicates. The same order is sent twice and becomes two invoices. Build so the same event can be handled more than once without anything doubling up.
• Expired refresh tokens. If an integration is not used for 60 days, the refresh token expires and the customer must approve it again.
• Traffic spikes. A promotion brings hundreds of orders in an hour. Queue the calls so you stay under 60 a minute.
• VAT and accounts. The wrong account or tax rate in the integration gives errors in your books. Let your accountant approve the mapping before going live.
• Nobody owns the flow. Decide who gets the alert when a sync fails.